@1e0zj/dsh-plugin-mall 0.3.0 → 0.3.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@1e0zj/dsh-plugin-mall",
-  "version": "0.3.0",
+  "version": "0.3.2",
   "description": "dsh 插件市场：搜索 GitHub dsh-plugin 话题下的插件仓库，一键安装到本地 dsh profile（agent 工具 + 设置页插件市场 tab）",
   "type": "module",
   "main": "src/index.js",

package/src/client.js

@@ -133,10 +133,29 @@ window.__ModuleLoader__.load({
     // onPreflightSettled：预检 job（kind=dsh-plugin-preflight）落定时回调，
     // 携带 (spec, report)。safe 由调用方直接续装；有风险由调用方出内联卡片。
     function useJobPolling(call, onSettled, onApprovalToken, onPreflightSettled) {
-      var jobsRef = useRef({});
-      var _jobs = useState({});
+      // 重挂载垫底：安装完成的收尾会写 cordis.patch.yml，dsh 随之重放装配树、
+      // 整个市场 UI 重挂载，React state 归零——面板先空一拍再被异步的
+      // call("jobs") 恢复，用户看到「任务清掉又回来」的割裂（实测反馈）。
+      // sessionStorage 镜像让重挂载的第一帧直接渲染上一帧的面板，随后的
+      // RPC 恢复用后端权威数据覆盖。tab 级存储，随 tab 关闭而清，
+      // 与内存里的任务数据同生命周期。
+      var JOBS_MIRROR_KEY = "@1e0zj/dsh-plugin-mall:jobs";
+      var readJobsMirror = function () {
+        try {
+          var parsed = JSON.parse(window.sessionStorage.getItem(JOBS_MIRROR_KEY) || "null");
+          return parsed && typeof parsed === "object" ? parsed : {};
+        } catch (e) { return {}; }
+      };
+      var jobsRef = useRef(null);
+      if (jobsRef.current === null) jobsRef.current = readJobsMirror();
+      var _jobs = useState(Object.assign({}, jobsRef.current));
       var jobs = _jobs[0];
       var setJobs = _jobs[1];
+      var commit = useCallback(function (next) {
+        jobsRef.current = next;
+        setJobs(Object.assign({}, next));
+        try { window.sessionStorage.setItem(JOBS_MIRROR_KEY, JSON.stringify(next)); } catch (e) { /* 存储被禁/写满不致命 */ }
+      }, []);
       useEffect(function () {
         var timer = setInterval(function () {
           var current = jobsRef.current;
@@ -165,15 +184,15 @@ window.__ModuleLoader__.load({
                 }
               }
               var output = (old.output || "") + (value.output || "");
-              jobsRef.current = Object.assign({}, jobsRef.current, { [id]: Object.assign({}, old, {
+              commit(Object.assign({}, jobsRef.current, { [id]: Object.assign({}, old, {
                 status: snapshot.status,
                 detail: snapshot.detail,
                 needsApproval: snapshot.needsApproval,
                 approvalToken: snapshot.approvalToken,
                 kind: snapshot.kind,
                 output: output,
-              }) });
-              setJobs(Object.assign({}, jobsRef.current));
+                finishedAt: snapshot.finishedAt,
+              }) }));
             }).catch(function () { /* keep polling */ });
           });
         }, 1200);
@@ -182,6 +201,9 @@ window.__ModuleLoader__.load({
       // carryFromId：把上一阶段（预检）的日志接过来并撤掉它的条目。一次点击
       // 只应该在面板里留下一个任务，日志连续——而不是 market-1 预检、
       // market-2 安装两条并排，让人以为自己点了两次。
+      // 重试同理：同一 spec 上一轮失败/完成的终态条目一并撤掉——用户没点
+      // 「清空」就重试时，面板照样只留新一轮一条。旧失败日志不拼进新任务
+      // （两轮 pnpm 输出混在一起没法读）；running 的不动，那是真并发任务。
       var track = useCallback(function (id, spec, carryFromId) {
         var next = Object.assign({}, jobsRef.current);
         var carried = "";
@@ -189,21 +211,72 @@ window.__ModuleLoader__.load({
           carried = next[carryFromId].output || "";
           delete next[carryFromId];
         }
+        for (var key in next) {
+          if (key !== id && next[key] && next[key].spec === spec && next[key].status !== "running") {
+            delete next[key];
+          }
+        }
         next[id] = { status: "running", spec: spec, output: carried };
-        jobsRef.current = next;
-        setJobs(Object.assign({}, next));
-      }, []);
+        commit(next);
+      }, [commit]);
       var clear = useCallback(function () {
-        jobsRef.current = {};
-        setJobs({});
-      }, []);
+        commit({});
+      }, [commit]);
       var drop = useCallback(function (id) {
         var next = Object.assign({}, jobsRef.current);
         delete next[id];
-        jobsRef.current = next;
-        setJobs(next);
-      }, []);
-      return { jobs: jobs, track: track, clear: clear, drop: drop };
+        commit(next);
+      }, [commit]);
+      // 恢复后端任务记录（tracker.list 的形状）：安装事务改写
+      // cordis.patch.yml 会让 dsh 重放装配树、整个市场 UI 重挂载，React
+      // state 全丢——任务面板、完成提醒、重启按钮一起消失（真实事故：
+      // 更新其实成功了，用户靠手动重启+查版本才确认）。记录在后端活着，
+      // 挂载时拉回来。两个细节：恢复出的**已落定**预检任务标
+      // preflightHandled，否则轮询的第一拍会重放 onPreflightSettled——
+      // 那等于页面一刷新就自动续装一次；running 的不标，交回轮询线。
+      var restore = useCallback(function (entries) {
+        var next = Object.assign({}, jobsRef.current);
+        var serverIds = {};
+        for (var index = 0; index < (entries || []).length; index++) {
+          var entry = entries[index] || {};
+          var snap = entry.snapshot || {};
+          if (!entry.id) continue;
+          serverIds[entry.id] = true;
+          // 服务器记录是权威（覆盖垫底镜像）；本地独有的 id 保留——后端
+          // 修剪掉的旧条目不至于从面板上闪没。
+          next[entry.id] = {
+            status: snap.status,
+            spec: snap.spec,
+            detail: snap.detail,
+            needsApproval: snap.needsApproval,
+            approvalToken: snap.approvalToken,
+            kind: snap.kind,
+            output: entry.output || "",
+            finishedAt: snap.finishedAt,
+            preflightHandled: snap.kind === "dsh-plugin-preflight" && snap.status !== "running",
+          };
+        }
+        // 不在本次服务器列表里的条目属于上一次宿主会话（进程重启后
+        // tracker 清空）。已兑现的直接翻篇撤掉：completed 的重启已经
+        // 发生；needsApproval 暂停的批准卡片已随进程失效（事务由启动
+        // 恢复处置），留着只会让人点一个必然失败的按钮。running 的标
+        // 中断，别让轮询对着不存在的 id 空转。failed 保留——日志还有
+        // 排障价值。这个判据不依赖 finishedAt（旧镜像里没有该字段）。
+        for (var key in next) {
+          if (serverIds[key]) continue;
+          var stale = next[key];
+          if (stale.status === "running") {
+            next[key] = Object.assign({}, stale, {
+              status: "killed",
+              detail: "宿主进程已重启，该任务的记录随之丢失",
+            });
+          } else if (stale.status === "completed" || (Array.isArray(stale.needsApproval) && stale.needsApproval.length > 0)) {
+            delete next[key];
+          }
+        }
+        commit(next);
+      }, [commit]);
+      return { jobs: jobs, track: track, clear: clear, drop: drop, restore: restore };
     }
 
     // ── plugin verification badge ───────────────────────────────────────────
@@ -417,10 +490,12 @@ window.__ModuleLoader__.load({
                 needsApproval: job.needsApproval,
                 busy: props.approving === job.spec,
                 onApprove: function (names) {
-                  if (typeof props.onDrop === "function") {
-                    props.onDrop(id);
-                  }
-                  props.onApprove(job.spec, names, job.approvalToken);
+                  // 不先 drop：旧条目由重试任务的 track(carryFromId) 原子接管
+                  // （撤条目 + 日志接续一拍完成）。先删的话，call("install")
+                  // 要走数秒（重试还会重跑一次隔离预检），面板会空白一段，
+                  // 「批准后任务消失、开始安装才冒出来」的割裂就是这么来的。
+                  // 等待期间按钮由 approving 态显示「继续中…」。
+                  props.onApprove(job.spec, names, job.approvalToken, id);
                 },
                 onDismiss: function () { props.onDismiss(id); },
               })
@@ -429,11 +504,16 @@ window.__ModuleLoader__.load({
             // 也不再重复一个绿色「完成」：状态行已经写了「· 完成」。
             done && job.status === "completed" && job.kind !== "dsh-plugin-preflight"
               ? h("div", { className: "mkt_jobDone" },
-                h("button", {
-                  className: "mkt_btn mkt_btnPrimary mkt_btnSm",
-                  disabled: props.restarting === true,
-                  onClick: props.onRestart,
-                }, props.restarting ? "重启中…" : "重启 dsh 生效"))
+                // 完成时间早于本次宿主启动 = 重启已经发生过了（防御分支：
+                // 已兑现的条目通常在恢复时就被撤掉了）：换成说明文字，
+                // 不再催一次没必要的重启。
+                props.hostStartedAt && job.finishedAt && job.finishedAt < props.hostStartedAt
+                  ? h("span", { className: "mkt_meta" }, "重启已生效")
+                  : h("button", {
+                    className: "mkt_btn mkt_btnPrimary mkt_btnSm",
+                    disabled: props.restarting === true,
+                    onClick: props.onRestart,
+                  }, props.restarting ? "重启中…" : "重启 dsh 生效"))
               : job.status === "failed" && !(job.needsApproval && job.needsApproval.length > 0)
                 ? h("div", { className: "mkt_error" }, "失败，见下方输出")
                 : null,
@@ -559,6 +639,11 @@ window.__ModuleLoader__.load({
       var _restarting = useState(false);
       var restarting = _restarting[0];
       var setRestarting = _restarting[1];
+      // 本次宿主进程的启动时间（jobs 端点带回）：完成时间早于它的任务，
+      // 其「重启 dsh 生效」按钮已经兑现，改显示「重启已生效」。
+      var _hostStartedAt = useState(0);
+      var hostStartedAt = _hostStartedAt[0];
+      var setHostStartedAt = _hostStartedAt[1];
       var _preflight = useState(null);
       var preflight = _preflight[0];
       var setPreflight = _preflight[1];
@@ -716,6 +801,14 @@ window.__ModuleLoader__.load({
 
       useEffect(function () {
         doSearch();
+        // 挂载即恢复任务面板（见 useJobPolling.restore 的注释）：重挂载丢掉
+        // 的完成提醒、重启按钮、暂停中的批准卡片都从后端拉回来。
+        // hostStartedAt：本次宿主进程的启动时间——早于它的完成任务说明
+        // 重启已经发生，按钮要换成「重启已生效」而不是再催一次。
+        call("jobs", {}).then(function (value) {
+          if (value.hostStartedAt) setHostStartedAt(value.hostStartedAt);
+          polling.restore(value.jobs);
+        }).catch(function () { /* 恢复失败不阻塞面板 */ });
         // eslint-disable-next-line react-hooks/exhaustive-deps
       }, []);
 
@@ -740,14 +833,14 @@ window.__ModuleLoader__.load({
         });
       }, [call, track]);
 
-      var doApprove = useCallback(function (spec, names, token) {
+      var doApprove = useCallback(function (spec, names, token, carryFromId) {
         var extra = { allowBuildScripts: names };
         var apprToken = token || approvalTokensRef.current[spec];
         if (apprToken) {
           extra.approvalToken = apprToken;
           delete approvalTokensRef.current[spec];
         }
-        doRawInstall(spec, extra);
+        doRawInstall(spec, extra, carryFromId);
       }, [doRawInstall]);
 
       // 预检落定后的去向：safe 直接续装，其余出内联风险卡片。
@@ -904,6 +997,7 @@ window.__ModuleLoader__.load({
           onDrop: dropJob,
           onRestart: doRestart,
           restarting: restarting,
+          hostStartedAt: hostStartedAt,
           approving: Object.keys(installing).filter(function (s) { return installing[s]; })[0],
         }),
         preflight ? h(PreflightCard, {

package/src/guard.js

@@ -583,9 +583,9 @@ export function inspectRemoteCandidate({ profileDir, manifest, patchText, spec }
 }
 
 /** Locate a binary on PATH by explicit extension (no shell, no PATHEXT guessing). */
-function findOnPath(binary, extensions) {
-  const separator = process.platform === "win32" ? ";" : ":";
-  for (const dir of String(process.env.PATH ?? "").split(separator)) {
+function findOnPath(binary, { platform, pathEnv, extensions }) {
+  const separator = platform === "win32" ? ";" : ":";
+  for (const dir of String(pathEnv ?? "").split(separator)) {
     if (dir.length === 0) continue;
     for (const ext of extensions) {
       const candidate = join(dir, `${binary}${ext}`);
@@ -596,16 +596,32 @@ function findOnPath(binary, extensions) {
 }
 
 /**
- * pnpm spawn plan, mirroring installer.js pnpmSpawnPlan: a real .exe spawns
- * without a shell; only the .cmd shim forces a cmd wrapper on Windows
- * (shell:true, and Node's DEP0190 warning with it).
+ * How to spawn pnpm on this platform. installer.js consumes this too, so the
+ * plan lives here exactly once instead of as two drifting copies (the mirror
+ * copies had already diverged once; that is how the quoting bug below stayed
+ * invisible on both sides).
+ * @returns {{ command: string, shell: boolean, treeKill: boolean }}
+ *   treeKill marks the shell-wrapped case: cancel must taskkill /T the tree.
  */
-function pnpmSpawnPlan() {
-  if (process.platform !== "win32") return { command: "pnpm", shell: false };
-  const exe = findOnPath("pnpm", [".exe"]);
-  if (exe !== undefined) return { command: exe, shell: false };
-  const cmd = findOnPath("pnpm", [".cmd"]);
-  return { command: cmd ?? "pnpm", shell: true };
+export function pnpmSpawnPlan({ platform = process.platform, pathEnv = process.env.PATH } = {}) {
+  if (platform !== "win32") return { command: "pnpm", shell: false, treeKill: false };
+  // A real .exe spawns without a shell — cancel then kills pnpm itself.
+  const exe = findOnPath("pnpm", { platform, pathEnv, extensions: [".exe"] });
+  if (exe !== undefined) return { command: exe, shell: false, treeKill: false };
+  // Only the .cmd shim: Node refuses batch files with shell:false (EINVAL
+  // since the batch-file argument-injection fix), so a cmd wrapper is
+  // unavoidable — flag it so cancel kills the whole tree, not the wrapper.
+  const cmd = findOnPath("pnpm", { platform, pathEnv, extensions: [".cmd"] });
+  if (cmd === undefined) return { command: "pnpm", shell: true, treeKill: true };
+  // The shim usually sits in a directory with a space (`D:\Program Files\nodejs`
+  // is Node's default install layout). Under shell:true Node joins command and
+  // args with spaces WITHOUT quoting per argument — the same fact the
+  // UNSAFE_SPEC_RE comment below argues from — so an unquoted path is cut at
+  // the first space and cmd answers `'D:\Program' is not recognized`, killing
+  // every preflight and install on such machines. Quote the command ourselves;
+  // the args joined after it are fixed flags plus an assertSafeSpec-validated
+  // spec, none of which carry spaces.
+  return { command: `"${cmd}"`, shell: true, treeKill: true };
 }
 
 function spawnCapture(command, args, options, onOutput) {
@@ -641,7 +657,9 @@ function spawnCapture(command, args, options, onOutput) {
 // not only by the agent/browser callers that happen to check first: anything
 // carrying shell metacharacters, or a Windows `file:`/`link:` path with spaces,
 // is refused before a single byte of filesystem work and before pnpm is spawned.
-const UNSAFE_SPEC_RE = /[;&|`$()<>^"!*\n\r]/;
+// `%` is on the list like everywhere else: cmd performs `%VAR%` expansion, and
+// the expanded value (often full of spaces and semicolons) reshapes the argv.
+const UNSAFE_SPEC_RE = /[;&|`$()<>^%!"*\n\r]/;
 
 function assertSafeSpec(spec) {
   const value = String(spec ?? "");
@@ -862,7 +880,7 @@ function sanitizeSnapshot(marker, home) {
 }
 
 /** Read and validate a profile's pending marker; undefined when none exists. */
-function readValidatedPendingSnapshot(profileDir) {
+export function readValidatedPendingSnapshot(profileDir) {
   const resolved = resolve(profileDir);
   const filePath = pendingPath(resolved);
   if (!existsSync(filePath)) return undefined;
@@ -1024,6 +1042,74 @@ function reconcileInstallArgs() {
   ];
 }
 
+/**
+ * Args for the per-package fallback reinstall. pnpm 11's headless "up to date"
+ * short-circuit (node_modules/.pnpm/lock.yaml) can skip a `--frozen` install
+ * even while the package is actually missing — `--force` does not bypass it
+ * (verified on a real profile, twice, each time leaving the profile without
+ * the plugin and dsh unable to boot). `pnpm add <spec>` always goes through
+ * full resolution, so it is the reliable way to relink one missing direct
+ * dependency. Still strictly offline.
+ */
+function fallbackAddArgs(target) {
+  return [
+    "add", target,
+    "--ignore-scripts",
+    "--config.auto-install-peers=false",
+    "--reporter=append-only",
+    "--offline",
+  ];
+}
+
+/**
+ * The argv target for a fallback `pnpm add` of one restored dependency, or
+ * undefined when that spec cannot be added offline and safely. Semver ranges
+ * become `name@range`, local file:/link: paths add by the spec itself;
+ * github:/git+ specs need the network or git and stay fail-closed, and
+ * anything carrying shell metacharacters (a multi-clause range like
+ * `^1.0.0 || ^2.0.0` contains spaces and pipes) is skipped — the
+ * shell-wrapped pnpm spawn joins argv with spaces without quoting.
+ */
+function fallbackAddTarget(name, spec) {
+  const range = String(spec ?? "");
+  if (range.length === 0) return undefined;
+  const isLocal = /^(?:file:|link:)/i.test(range);
+  if (!isLocal && validRange(range) === null) return undefined;
+  const target = isLocal ? range : `${name}@${range}`;
+  try {
+    assertSafeSpec(target);
+  } catch {
+    return undefined;
+  }
+  return target;
+}
+
+/**
+ * Run one fallback `pnpm add` synchronously. Same contract as
+ * runReconcileInstall: never throws, failures surface as a nonzero exit.
+ */
+function runFallbackAdd(profileDir, target) {
+  let result;
+  try {
+    const plan = pnpmSpawnPlan();
+    result = spawnSync(plan.command, fallbackAddArgs(target), {
+      cwd: profileDir,
+      env: pnpmGuardEnv(),
+      shell: plan.shell,
+      encoding: "utf8",
+      timeout: 180000,
+      windowsHide: true,
+    });
+  } catch (error) {
+    return { exitCode: 1, output: "", error };
+  }
+  return {
+    exitCode: typeof result.status === "number" ? result.status : 1,
+    output: `${result.stdout ?? ""}${result.stderr ?? ""}`,
+    error: result.error,
+  };
+}
+
 /**
  * Run the offline reconcile install synchronously (rollback is a sync
  * recovery path, called from CLI/startup contexts that cannot await). Never
@@ -1206,6 +1292,28 @@ export function rollbackPendingSnapshot(profileDir) {
     }
   }
 
+  if (unsatisfied.length > 0) {
+    // pnpm 11's headless short-circuit (node_modules/.pnpm/lock.yaml) can turn
+    // the reconcile above into a no-op ("Already up to date") while the package
+    // is actually gone — `--force` does not bypass it. Twice on a real profile
+    // that left the plugin missing and dsh unable to boot. Retry the still-
+    // missing direct dependencies one at a time with `pnpm add` (full
+    // resolution, still offline), then put the snapshot bytes back over
+    // whatever pnpm wrote: the add is only the means to relink node_modules,
+    // the snapshot stays authoritative for the declaration files.
+    for (const depName of [...unsatisfied]) {
+      const target = fallbackAddTarget(depName, restoredDependencies[depName]);
+      if (target === undefined) continue; // not offline-addable — fail closed below
+      const addAttempt = runFallbackAdd(profileDir, target);
+      if (addAttempt.exitCode === 0) {
+        restoreProfileSnapshot(pending);
+        if (candidateRestoredCompatible(profileDir, depName, restoredDependencies[depName])) {
+          unsatisfied.splice(unsatisfied.indexOf(depName), 1);
+        }
+      }
+    }
+  }
+
   if (unsatisfied.length > 0) {
     const why =
       wasUpdate && pending.files?.["pnpm-lock.yaml"]?.present !== true
@@ -1217,9 +1325,10 @@ export function rollbackPendingSnapshot(profileDir) {
             : "node_modules missing direct dependency";
     const tail = String(attempt?.output ?? "").replace(/\s+/g, " ").trim().slice(-400);
     // KEEP the marker + snapshot: the profile files are already restored,
-    // so a retry (`guard recover`) or a manual pnpm install finishes it.
+    // so a retry (`guard recover`), the per-package `pnpm add` above, or a
+    // manual pnpm install finishes it.
     throw new Error(
-      `rollback restored the profile files and removed the failed install, but direct dependencies in node_modules are missing or incompatible (${unsatisfied.join(", ")}; ${why}) — the pending marker and snapshot were KEPT; re-run \`guard recover\` or run \`pnpm install --ignore-scripts --frozen-lockfile\` in ${profileDir} manually${tail ? `. pnpm output: ${tail}` : ""}`
+      `rollback restored the profile files and removed the failed install, but direct dependencies in node_modules are missing or incompatible even after the offline reconcile and per-package add fallback (${unsatisfied.join(", ")}; ${why}) — the pending marker and snapshot were KEPT; re-run \`guard recover\` or run \`pnpm install --ignore-scripts --frozen-lockfile\` in ${profileDir} manually${tail ? `. pnpm output: ${tail}` : ""}`
     );
   }
 
@@ -1888,6 +1997,12 @@ async function selfTest() {
       if (rep.verdict !== "blocked" || !rep.issues.some((entry) => entry.code === "unsafe-spec")) {
         throw new Error("preflightInstall should reject a spec with shell metacharacters before spawning");
       }
+      // `%` 单独成案：它不是 POSIX 元字符，但 cmd 会做 %VAR% 展开，展开值
+      // 里的分号/空格足以重塑 argv——黑名单曾漏掉它，与 cli.js 漂移过。
+      const repPct = await preflightInstall({ profileDir: p, spec: "evil-pkg%PATH%" });
+      if (repPct.verdict !== "blocked" || !repPct.issues.some((entry) => entry.code === "unsafe-spec")) {
+        throw new Error("preflightInstall should reject a spec carrying cmd %VAR% expansion");
+      }
       if (process.platform === "win32") {
         const repWin = await preflightInstall({ profileDir: p, spec: "file:C:\\some dir\\pkg" });
         if (repWin.verdict !== "blocked" || !repWin.issues.some((entry) => entry.code === "unsafe-spec")) {
@@ -1906,6 +2021,36 @@ async function selfTest() {
       if (!args.includes("--ignore-scripts")) throw new Error("probe args must keep install scripts disabled");
     }
 
+    // pnpmSpawnPlan (pure, plus a real spawn on Windows): the .cmd shim path
+    // must carry its own quotes. Node's shell:true joins command and args
+    // without per-argument quoting, so `D:\Program Files\nodejs\pnpm.CMD`
+    // would be cut at the first space and cmd would answer
+    // `'D:\Program' is not recognized` — that exact failure blocked every
+    // preflight on a real machine (Node's default install layout has a space).
+    {
+      const shimRoot = join(root, "path with space");
+      mkdirSync(shimRoot, { recursive: true });
+      writeFileSync(join(shimRoot, "pnpm.cmd"), "@echo probe-ok\r\n");
+      const plan = pnpmSpawnPlan({ platform: "win32", pathEnv: shimRoot });
+      if (plan.shell !== true || plan.treeKill !== true || plan.command !== `"${join(shimRoot, "pnpm.cmd")}"`) {
+        throw new Error(`quoted .cmd plan expected, got ${JSON.stringify(plan)}`);
+      }
+      if (pnpmSpawnPlan({ platform: "linux", pathEnv: shimRoot }).command !== "pnpm") {
+        throw new Error("posix plan should spawn pnpm directly");
+      }
+      const noShim = pnpmSpawnPlan({ platform: "win32", pathEnv: join(root, "no-shim-here") });
+      if (noShim.command !== "pnpm" || noShim.shell !== true || noShim.treeKill !== true) {
+        throw new Error(`missing-shim fallback expected, got ${JSON.stringify(noShim)}`);
+      }
+      // 引用不是摆设：Windows 真机端到端 spawn 一轮（CI 是 Linux，只跑静态断言）。
+      if (process.platform === "win32") {
+        const probe = spawnSync(plan.command, ["--version"], { shell: plan.shell, encoding: "utf8", timeout: 15000 });
+        if (probe.status !== 0 || !/probe-ok/.test(probe.stdout ?? "")) {
+          throw new Error(`quoted shim must actually run: status=${probe.status} stdout=${JSON.stringify(probe.stdout)} stderr=${JSON.stringify(probe.stderr)}`);
+        }
+      }
+    }
+
     // Rollback reconcile args/env (pure): scripts off, the restored lockfile
     // authoritative, peer auto-install off, strictly offline — there is no
     // online retry path or args at all, and nothing user-controlled anywhere
@@ -2014,6 +2159,91 @@ async function selfTest() {
       if (attempts.length !== 1) throw new Error(`the rollback must run exactly ONE offline reconcile, got ${attempts.length}`);
     }
 
+    // The reconcile no-op trap, met twice on a real profile: pnpm 11's headless
+    // short-circuit answers `install --frozen` with exit 0 / "Already up to
+    // date" while the package is actually missing (--force does not bypass it),
+    // leaving dsh unable to boot. The stub models exactly that: `install` exits
+    // 0 and does NOTHING; only the per-package `add` fallback relinks the old
+    // copy — and it also rewrites package.json the way a real pnpm would
+    // ("^1.0.0"), which the snapshot-byte restore must overwrite. Expected:
+    // reconcile attempt, add attempt, marker + snapshot cleared, node_modules
+    // restored, and the declaration files byte-identical to the snapshot.
+    {
+      const p = join(root, "profiles", "update-reconcile-noop");
+      mkdirSync(join(p, "node_modules", "good"), { recursive: true });
+      writeFileSync(join(p, "package.json"), JSON.stringify({ dependencies: { good: "1.0.0" } }));
+      writeFileSync(join(p, "cordis.patch.yml"), "[]\n");
+      writeFileSync(join(p, "pnpm-lock.yaml"), "lockfileVersion: '9.0'\n\nimporters: {}\n");
+      writeFileSync(join(p, "node_modules", "good", "package.json"), JSON.stringify({ name: "good", version: "2.0.0" }));
+      const binDir = join(root, "stub-bin-noop-install");
+      mkdirSync(binDir);
+      const attemptsFile = join(binDir, "attempts.txt");
+      const isWin = process.platform === "win32";
+      const stubPath = join(binDir, isWin ? "pnpm.cmd" : "pnpm");
+      writeFileSync(stubPath, isWin
+        ? `@echo off\r\nif "%1"=="add" goto add\r\necho install>> "${attemptsFile}"\r\nexit /b 0\r\n:add\r\nmkdir node_modules\\good 2>nul\r\necho {"name":"good","version":"1.0.0"}> node_modules\\good\\package.json\r\necho {"dependencies":{"good":"^^1.0.0"}}> package.json\r\necho add>> "${attemptsFile}"\r\nexit /b 0\r\n`
+        : `#!/bin/sh\nif [ "$1" = "add" ]; then\n  mkdir -p node_modules/good\n  printf '%s' '{"name":"good","version":"1.0.0"}' > node_modules/good/package.json\n  printf '%s' '{"dependencies":{"good":"^1.0.0"}}' > package.json\n  echo add >> '${attemptsFile}'\n  exit 0\nfi\necho install >> '${attemptsFile}'\nexit 0\n`);
+      if (!isWin) chmodSync(stubPath, 0o755);
+      const snap = createProfileSnapshot(p, { spec: "good@2.0.0" });
+      markPendingSnapshot(snap, { spec: "good@2.0.0", preflight: { candidate: { name: "good", version: "2.0.0", kind: "plain" } } });
+      const previousPath = process.env.PATH;
+      process.env.PATH = `${binDir}${delimiter}${previousPath ?? ""}`;
+      try {
+        rollbackPendingSnapshot(p);
+      } finally {
+        if (previousPath === undefined) delete process.env.PATH;
+        else process.env.PATH = previousPath;
+      }
+      if (readPendingSnapshot(p) !== undefined) throw new Error("an add-fallback-rescued rollback must clear the marker");
+      if (existsSync(snap.dir)) throw new Error("an add-fallback-rescued rollback must delete the snapshot dir");
+      if (readJson(join(p, "node_modules", "good", "package.json")).version !== "1.0.0") throw new Error("the add fallback must relink the old version");
+      if (readJson(join(p, "package.json")).dependencies?.good !== "1.0.0") throw new Error("snapshot bytes must win over the add's manifest rewrite");
+      const attempts = readFileSync(attemptsFile, "utf8").split(/\r?\n/).filter((line) => line.trim().length > 0);
+      if (attempts.join(",") !== "install,add") throw new Error(`expected the no-op reconcile then exactly one add fallback, got ${attempts.join(",")}`);
+    }
+
+    // The same no-op reconcile with an add that also fails (exit 1): rollback
+    // must stay fail-closed — throw, KEEP marker + snapshot, declarations stay
+    // at their snapshot bytes.
+    {
+      const p = join(root, "profiles", "update-reconcile-noop-fail");
+      mkdirSync(join(p, "node_modules", "good"), { recursive: true });
+      writeFileSync(join(p, "package.json"), JSON.stringify({ dependencies: { good: "1.0.0" } }));
+      writeFileSync(join(p, "cordis.patch.yml"), "[]\n");
+      writeFileSync(join(p, "pnpm-lock.yaml"), "lockfileVersion: '9.0'\n\nimporters: {}\n");
+      writeFileSync(join(p, "node_modules", "good", "package.json"), JSON.stringify({ name: "good", version: "2.0.0" }));
+      const binDir = join(root, "stub-bin-add-fails");
+      mkdirSync(binDir);
+      const attemptsFile = join(binDir, "attempts.txt");
+      const isWin = process.platform === "win32";
+      const stubPath = join(binDir, isWin ? "pnpm.cmd" : "pnpm");
+      writeFileSync(stubPath, isWin
+        ? `@echo off\r\necho %1>> "${attemptsFile}"\r\nexit /b 1\r\n`
+        : `#!/bin/sh\necho "$1" >> '${attemptsFile}'\nexit 1\n`);
+      if (!isWin) chmodSync(stubPath, 0o755);
+      const snap = createProfileSnapshot(p, { spec: "good@2.0.0" });
+      markPendingSnapshot(snap, { spec: "good@2.0.0", preflight: { candidate: { name: "good", version: "2.0.0", kind: "plain" } } });
+      const previousPath = process.env.PATH;
+      process.env.PATH = `${binDir}${delimiter}${previousPath ?? ""}`;
+      let threw = false;
+      try {
+        rollbackPendingSnapshot(p);
+      } catch {
+        threw = true;
+      } finally {
+        if (previousPath === undefined) delete process.env.PATH;
+        else process.env.PATH = previousPath;
+      }
+      if (!threw) throw new Error("a rollback whose reconcile no-ops AND add fallback fails must throw");
+      if (readPendingSnapshot(p)?.id !== snap.id) throw new Error("the failed rollback must KEEP the pending marker");
+      if (!existsSync(snap.dir)) throw new Error("the failed rollback must KEEP the snapshot dir");
+      if (readJson(join(p, "package.json")).dependencies?.good !== "1.0.0") throw new Error("the manifest must stay restored when the add fallback fails");
+      const attempts = readFileSync(attemptsFile, "utf8").split(/\r?\n/).filter((line) => line.trim().length > 0);
+      if (attempts.join(",") !== "install,add") throw new Error(`expected exactly one reconcile and one add attempt, got ${attempts.join(",")}`);
+      rmSync(pendingPath(p), { force: true });
+      rmSync(snap.dir, { recursive: true, force: true });
+    }
+
     // The same interrupted update, but the reconcile never relinks the old
     // copy and only an ANCESTOR node_modules still provides a satisfying
     // version. Falling back to Node resolution would accept that copy — the

package/src/index.js

@@ -144,6 +144,13 @@ export function computeProfileFingerprint(profileDir) {
 const compatCache = new Map();
 const COMPAT_TTL = 600000;
 
+// When this plugin instance loaded — for a host process this is effectively the
+// host's start time (the loader mounts plugins at boot). Sent with `jobs` so a
+// remounted client can tell "completed, restart still pending" from "completed
+// and the restart already happened": a finishedAt older than this value means
+// the task's Restart-dsh button has already done its job.
+const pluginLoadedAt = Date.now();
+
 function compatCacheGet(key) {
   const cached = compatCache.get(key);
   if (cached === undefined) return undefined;
@@ -918,6 +925,13 @@ export function createJobTracker({ producerFactory } = {}) {
       const record = records.get(String(jobId));
       if (record === undefined) throw new Error(`unknown install job ${JSON.stringify(String(jobId))}`);
       const isSameSession = record.surface !== "browser" || (record.session !== "" && record.session === session);
+      const delta = typeof record.readOutput === "function"
+        ? record.readOutput()
+        : typeof record.producer?.readOutput === "function" ? record.producer.readOutput() : "";
+      // Accumulate the drained deltas so `list` can restore the full log after a
+      // remount: the polling client drains destructively, so without this the
+      // backend would hold no history at all.
+      record.log = String(record.log ?? "") + delta;
       return {
         snapshot: {
           id: record.id,
@@ -933,12 +947,48 @@ export function createJobTracker({ producerFactory } = {}) {
           startedAt: record.startedAt,
           finishedAt: record.finishedAt,
         },
-        output: typeof record.readOutput === "function"
-          ? record.readOutput()
-          : typeof record.producer?.readOutput === "function" ? record.producer.readOutput() : "",
+        output: delta,
       };
     },
 
+    /**
+     * Every live record as {id, snapshot, output}, oldest first — for a freshly
+     * mounted client to restore its task panel. The install of a plugin whose
+     * bundle patch rewrites cordis.patch.yml replays the assembly tree and
+     * remounts this very UI mid-flight, dropping every React state; the backend
+     * records survive (1h/20-entry prune), so the remounted panel can show the
+     * finished task, its log, and the restart button instead of going blank
+     * with no signal at all (real incident: an update finished, the panel
+     * vanished, and the user learned it worked only by checking versions after
+     * a manual restart). Session visibility mirrors get(); dismissed records
+     * are skipped — "清空" must survive a remount too.
+     */
+    list(session) {
+      const out = [];
+      for (const record of records.values()) {
+        if (record.dismissed === true) continue;
+        const isSameSession = record.surface !== "browser" || (record.session !== "" && record.session === session);
+        out.push({
+          id: record.id,
+          snapshot: {
+            id: record.id,
+            kind: record.kind,
+            label: record.label,
+            status: record.status,
+            detail: record.detail,
+            needsApproval: record.needsApproval,
+            approvalToken: isSameSession ? record.approvalToken : undefined,
+            extras: isSameSession ? record.extras : undefined,
+            spec: record.spec,
+            startedAt: record.startedAt,
+            finishedAt: record.finishedAt,
+          },
+          output: String(record.log ?? ""),
+        });
+      }
+      return out;
+    },
+
     cancel(jobId, session) {
       const record = records.get(String(jobId));
       if (record === undefined) throw new Error(`unknown install job ${JSON.stringify(String(jobId))}`);
@@ -969,6 +1019,9 @@ export function createJobTracker({ producerFactory } = {}) {
       if (record.surface === "browser" && (record.session === "" || record.session !== session)) {
         return false;
       }
+      // Marked, not deleted: `list` (panel restore after a remount) skips these,
+      // so a cleared panel stays cleared across remounts.
+      record.dismissed = true;
       if (record.approvalToken) {
         invalidateApprovalToken(record.approvalToken, record.session || undefined, record.surface);
         record.approvalToken = undefined;
@@ -1482,6 +1535,17 @@ async function rpcDispatch(ctx, endpoint, payload, config, token, tracker) {
         return rpcFail(error);
       }
     }
+    case "jobs": {
+      // Panel restore for a freshly mounted client: an install that rewrites
+      // cordis.patch.yml replays the assembly tree and remounts this UI,
+      // dropping all React state. The task records live here.
+      try {
+        const session = requireBrowserSession(payload?.session);
+        return rpcOk({ jobs: tracker.list(session), hostStartedAt: pluginLoadedAt });
+      } catch (error) {
+        return rpcFail(error);
+      }
+    }
     case "restart": {
       const profile = String(payload?.profile ?? defaultProfile).trim();
       try {
@@ -2291,6 +2355,52 @@ export async function runSelfTests() {
     const snapAfterDismiss = sessionTracker.get(sessionJobId, "session-alpha").snapshot;
     check("dismiss 后 job snapshot 中 approvalToken 为 undefined", snapAfterDismiss.approvalToken === undefined);
 
+    // ── 5b. list（重挂载恢复）：日志累积、dismissed 过滤、session 隔离 ────────
+    // 安装事务改写 cordis.patch.yml 会让 dsh 重放装配树、市场 UI 整体重挂载，
+    // 前端 state 全丢。任务记录在后端活着——list 就是恢复通道：drain 过的
+    // 日志增量必须已在后端累积成全量，「清空」过的条目不得被拉回。
+    {
+      const pendingLines = ["line-a\n", "line-b\n"];
+      const lineProducer = {
+        cancel: () => {},
+        done: Promise.resolve({ status: "completed", detail: "done" }),
+        readOutput: () => pendingLines.shift() ?? "",
+      };
+      const listTracker = createJobTracker({ producerFactory: () => lineProducer });
+      const listJobId = listTracker.start({
+        profile: "web",
+        spec: "log-pkg",
+        profileDir,
+        surface: "browser",
+        session: "session-alpha",
+      });
+      await new Promise((resolvePromise) => setImmediate(resolvePromise));
+      const drain1 = listTracker.get(listJobId, "session-alpha").output;
+      const drain2 = listTracker.get(listJobId, "session-alpha").output;
+      const restoredJob = listTracker.list("session-alpha").find((entry) => entry.id === listJobId);
+      check(
+        "list 恢复全量日志（drain 过的增量在后端累积成完整历史）",
+        drain1 === "line-a\n" && drain2 === "line-b\n"
+          && restoredJob !== undefined
+          && restoredJob.output === "line-a\nline-b\n"
+          && restoredJob.snapshot.status === "completed"
+          && restoredJob.snapshot.spec === "log-pkg",
+        JSON.stringify({ drain1, drain2, restored: restoredJob?.output }),
+      );
+      const crossSessionJob = listTracker.list("session-beta").find((entry) => entry.id === listJobId);
+      check(
+        "list 对异 session 不暴露 approvalToken/extras（与 get 同规格）",
+        crossSessionJob !== undefined
+          && crossSessionJob.snapshot.approvalToken === undefined
+          && crossSessionJob.snapshot.extras === undefined,
+      );
+      listTracker.dismiss(listJobId, "session-alpha");
+      check(
+        "dismiss 后 list 不再返回该条（「清空」跨重挂载存活）",
+        listTracker.list("session-alpha").every((entry) => entry.id !== listJobId),
+      );
+    }
+
     // ── 6. Windows profile names & restart plan ──────────────────────────────
     check("合法 profile 名称识别", isSafeProfileName("web", true) && isSafeProfileName("profile_1", true) && isSafeProfileName("dev-test", true));
     check("Windows 尾随点拒绝", !isSafeProfileName("web.", true) && !isSafeProfileName("test..", true));

package/src/installer.js

@@ -16,7 +16,7 @@ import { createHash } from "node:crypto";
 import { dump, load } from "js-yaml";
 import { DEFAULT_PROFILE_BUNDLES, PROFILE_TEMPLATES, initProfile, resolveProfileDir } from "@deepseek-ai/dsh-app-boot";
 import { describeBuildScripts, npmNameOf } from "./github.js";
-import { commitPendingSnapshot, createProfileSnapshot, markPendingSnapshot, pnpmGuardEnv, rollbackPendingSnapshot } from "./guard.js";
+import { commitPendingSnapshot, createProfileSnapshot, markPendingSnapshot, pnpmGuardEnv, pnpmSpawnPlan, readValidatedPendingSnapshot, rollbackPendingSnapshot } from "./guard.js";
 
 // ── spec normalization ──────────────────────────────────────────────────────
 
@@ -1132,8 +1132,10 @@ export function createJobTracker() {
 
 // Windows spawn 走 shell，spec 会被拼进 cmd 行；agent 传入的参数不可信。
 // 合法的 npm 名 / github:owner\/repo / git·file·link·URL spec 都不含这些
-// shell 元字符——出现即拒绝，宁可误杀不放开命令注入面。
-const UNSAFE_SPEC_RE = /[;&|`$()<>^"!*\n\r]/;
+// shell 元字符——出现即拒绝，宁可误杀不放开命令注入面。`%` 在列：cmd 会
+// 做 `%VAR%` 环境变量展开，展开结果常含分号/空格，足以改变参数切分。
+// （cli.js 的同款黑名单一直含 %，此前三处已经漂移。）
+const UNSAFE_SPEC_RE = /[;&|`$()<>^%!"*\n\r]/;
 
 /** Reject install/remove specs carrying shell metacharacters. */
 export function assertSafeSpec(spec) {
@@ -1258,36 +1260,11 @@ function serializedProducer(lockKey, start) {
 // (a .cmd shim cannot be spawned with shell:false on modern Node), cancel
 // terminates the whole process tree and the done chain waits for the
 // wrapper's 'close' before any rollback runs.
-
-/** First `binary<ext>` found on PATH, or undefined. */
-function findOnPath(binary, { platform, pathEnv, extensions }) {
-  const separator = platform === "win32" ? ";" : ":";
-  for (const dir of String(pathEnv ?? "").split(separator)) {
-    if (dir.length === 0) continue;
-    for (const ext of extensions) {
-      const candidate = join(dir, `${binary}${ext}`);
-      if (existsSync(candidate)) return candidate;
-    }
-  }
-  return undefined;
-}
-
-/**
- * How to spawn pnpm on this platform.
- * @returns {{ command: string, shell: boolean, treeKill: boolean }}
- *   treeKill marks the shell-wrapped case: cancel must taskkill /T the tree.
- */
-function pnpmSpawnPlan({ platform = process.platform, pathEnv = process.env.PATH } = {}) {
-  if (platform !== "win32") return { command: "pnpm", shell: false, treeKill: false };
-  // A real .exe spawns without a shell — cancel then kills pnpm itself.
-  const exe = findOnPath("pnpm", { platform, pathEnv, extensions: [".exe"] });
-  if (exe !== undefined) return { command: exe, shell: false, treeKill: false };
-  // Only the .cmd shim: Node refuses batch files with shell:false (EINVAL
-  // since the batch-file argument-injection fix), so a cmd wrapper is
-  // unavoidable — flag it so cancel kills the whole tree, not the wrapper.
-  const cmd = findOnPath("pnpm", { platform, pathEnv, extensions: [".cmd"] });
-  return { command: cmd ?? "pnpm", shell: true, treeKill: true };
-}
+//
+// The plan itself is pnpmSpawnPlan in guard.js (imported above) — one
+// implementation, not a local mirror. It quotes the .cmd path: Node's
+// shell:true joins without per-argument quoting, and `D:\Program Files\…`
+// would be cut at the first space (`'D:\Program' is not recognized`).
 
 /**
  * Terminate a shell-wrapped process tree (Windows): taskkill /T /F kills the
@@ -1467,17 +1444,38 @@ function runInstallInner({ profile, spec, allowBuildScripts, approvedProof, pref
   // first live pnpm add runs. These are the files that decide what pnpm
   // installs and what dsh loads; the marker is what lets startup/CLI recovery
   // roll the profile back if the plugin proves unloadable.
-  let snapshot;
+  //
+  // An existing marker means one of two things. A needsApproval pause from a
+  // previous attempt of THIS SAME install resumes: its snapshot keeps the
+  // rollback target at "before this install first began", and re-snapshotting
+  // now would capture the paused half-installed state as the rollback target.
+  // Anything else (different spec, remove transaction, corrupt marker) is
+  // refused — the recovery path owns it.
+  let existingMarker;
   try {
-    snapshot = createProfileSnapshot(profileDir, { spec });
+    existingMarker = readValidatedPendingSnapshot(profileDir);
   } catch (error) {
-    return failedNow(`cannot snapshot profile before installing ${spec}: ${error.message} — refusing to touch the profile`);
+    return failedNow(`profile has an unreadable pending marker — refusing to install ${spec} (${error.message}); run \`dsh-plugin-guard guard recover\` first`);
   }
-  try {
-    markPendingSnapshot(snapshot, { spec, preflight });
-  } catch (error) {
-    rmSync(snapshot.dir, { recursive: true, force: true });
-    return failedNow(`cannot register the install pending marker for ${spec}: ${error.message} — refusing to touch the profile`);
+  if (existingMarker !== undefined) {
+    const previous = existingMarker.metadata?.spec ?? existingMarker.metadata?.packageName ?? "unknown";
+    if (existingMarker.operation !== "install" || existingMarker.metadata?.spec !== spec) {
+      return failedNow(`profile has a pending ${existingMarker.operation} transaction for ${JSON.stringify(previous)} — refusing to install ${spec}; restart dsh (startup recovery) or run \`dsh-plugin-guard guard recover\` first`);
+    }
+    push(`[dsh-plugin-mall] resuming the paused install transaction for ${spec} — its original snapshot stays the rollback target\n`);
+  } else {
+    let snapshot;
+    try {
+      snapshot = createProfileSnapshot(profileDir, { spec });
+    } catch (error) {
+      return failedNow(`cannot snapshot profile before installing ${spec}: ${error.message} — refusing to touch the profile`);
+    }
+    try {
+      markPendingSnapshot(snapshot, { spec, preflight });
+    } catch (error) {
+      rmSync(snapshot.dir, { recursive: true, force: true });
+      return failedNow(`cannot register the install pending marker for ${spec}: ${error.message} — refusing to touch the profile`);
+    }
   }
 
   // Neutralize existing allowBuilds before every first pnpm add so strict-dep-builds
@@ -1710,6 +1708,19 @@ function runInstallInner({ profile, spec, allowBuildScripts, approvedProof, pref
       }
       if (result.status === "completed") {
         // Keep the marker as-is
+      } else if (Array.isArray(result.needsApproval) && result.needsApproval.length > 0) {
+        // needsApproval is a PAUSE awaiting the user's decision, not a terminal
+        // failure — do not roll back. Rolling back would tear out the candidate
+        // pnpm just installed and rewrite the manifest to the old version, so
+        // the retry's profile fingerprint and preflight report drift with the
+        // changed on-disk state and the approval token's digest check can never
+        // pass (real incident: dsh-better-sidebar 0.12.3 → 0.13.0 update died
+        // exactly here, "invalid approval token: preflight report changed").
+        // The retry's rebuild branch also needs this tree in place. Leave the
+        // on-disk state and the marker for the token retry; an abandoned pause
+        // is settled by startup recovery / `guard recover`, whose rollback
+        // target is still the pre-first-attempt snapshot.
+        push("\n[dsh-plugin-mall] install paused for build-script approval — the candidate stays installed with its scripts blocked; approve in the UI to finish, or restart dsh / run `dsh-plugin-guard guard recover` to roll back\n");
       } else {
         try {
           rollbackPendingSnapshot(profileDir);
@@ -2051,6 +2062,17 @@ async function runTransactionFixtures() {
   const tick = () => new Promise((resolve) => setTimeout(resolve, 1));
   const flush = async (rounds = 5) => { for (let index = 0; index < rounds; index++) await tick(); };
 
+  // 纯函数前置：spec 黑名单。`%` 必须在内——cmd 的 %VAR% 展开元字符，
+  // 展开值里的分号/空格足以重塑 argv；三处黑名单曾漂移（cli.js 一直有，
+  // installer/guard 漏过）。
+  {
+    const rejects = (value) => {
+      try { assertSafeSpec(value); return false; } catch { return true; }
+    };
+    check("assertSafeSpec：cmd 的 %VAR% 展开元字符被拒绝", rejects("evil-pkg%PATH%"));
+    check("assertSafeSpec：正常 spec 不受影响", !rejects("some-plugin@1.0.0") && !rejects("github:owner/repo"));
+  }
+
   // 0. hashPackageTree 确定性与符号链接越界防御
   {
     const tempDir = mkdtempSync(join(tmpdir(), "dsh-mall-selftest-hash-"));
@@ -2105,7 +2127,9 @@ async function runTransactionFixtures() {
   }
 
   // 1a. exit 0 + "Ignored build scripts" 且未批准：必须停在批准闸（failed +
-  // needsApproval），携带 proof，绝不 finalize，回滚收掉 marker，且只 spawn 一次。
+  // needsApproval），携带 proof，绝不 finalize，且是暂停不是失败——现场与
+  // marker 原样保留给带 token 的重试（回滚会让重试的 approval token 必死，
+  // 见收尾处的真实事故注释），只 spawn 一次。
   {
     const { profileDir, cleanup } = makeTempProfile("ignored-gate");
     try {
@@ -2130,8 +2154,10 @@ async function runTransactionFixtures() {
         }],
       });
       const outcome = await producer.done;
+      const output = producer.readOutput();
+      const markerBefore = pendingMarkerPath(profileDir);
       check(
-        "退出码 0 + Ignored build scripts（未批准）→ 停在批准闸，返回 proof，不 finalize",
+        "退出码 0 + Ignored build scripts（未批准）→ 停在批准闸，返回 proof，不 finalize，暂停保留 marker",
         outcome.status === "failed"
           && Array.isArray(outcome.needsApproval)
           && outcome.needsApproval.some((entry) => entry.name === "node-pty")
@@ -2145,9 +2171,54 @@ async function runTransactionFixtures() {
             && entry.contentHash !== "0".repeat(64)
             && entry.weeklyDownloads === 123)
           && calls.length === 1
-          && !existsSync(pendingMarkerPath(profileDir)),
-        `status=${outcome.status} calls=${calls.length} marker=${existsSync(pendingMarkerPath(profileDir))}`,
+          && existsSync(markerBefore)
+          && /paused for build-script approval/.test(output),
+        `status=${outcome.status} calls=${calls.length} marker=${existsSync(markerBefore)}`,
       );
+
+      // 1a-bis. 同 spec 重试接管暂停的 marker：不再新建快照（回滚目标仍是
+      // 第一次安装前的现场），继续 spawn pnpm；异 spec 则拒绝且不 spawn。
+      {
+        const snapshotRootDir = join(dirname(dirname(profileDir)), "guard", "snapshots");
+        const snapshotsBefore = readdirSync(snapshotRootDir, { withFileTypes: true }).filter((e) => e.isDirectory()).length;
+        const retry = scriptedSpawn([{ code: 0, out: "Ignored build scripts: node-pty@1.0.0\nDone\n" }]);
+        const retryProducer = runInstall({
+          profile: "p",
+          spec: "some-plugin",
+          preflight: preflightStub("some-plugin"),
+          _profileDir: profileDir,
+          _spawn: retry.spawnFn,
+          _describe: async () => [],
+        });
+        const retryOutcome = await retryProducer.done;
+        const retryOutput = retryProducer.readOutput();
+        const snapshotsAfter = readdirSync(snapshotRootDir, { withFileTypes: true }).filter((e) => e.isDirectory()).length;
+        check(
+          "同 spec 重试接管暂停的 marker → 复用原快照，继续安装而非拒绝",
+          retryOutcome.status === "failed"
+            && Array.isArray(retryOutcome.needsApproval)
+            && retry.calls.length === 1
+            && /resuming the paused install transaction/.test(retryOutput)
+            && snapshotsAfter === snapshotsBefore,
+          `status=${retryOutcome.status} calls=${retry.calls.length} snapshots=${snapshotsBefore}->${snapshotsAfter}`,
+        );
+        const other = scriptedSpawn([{ code: 0, out: "Done\n" }]);
+        const otherOutcome = await runInstall({
+          profile: "p",
+          spec: "another-plugin",
+          preflight: preflightStub("another-plugin"),
+          _profileDir: profileDir,
+          _spawn: other.spawnFn,
+          _describe: async () => [],
+        }).done;
+        check(
+          "异 spec 遇暂停 marker → 拒绝且不 spawn",
+          otherOutcome.status === "failed"
+            && /pending install transaction/.test(otherOutcome.detail ?? "")
+            && other.calls.length === 0,
+          `status=${otherOutcome.status} calls=${other.calls.length}`,
+        );
+      }
       const call = calls[0] ?? { args: [], options: {} };
       check(
         "实装 argv/env：strict-dep-builds + peer 关闭 + cwd/shell 正确",
@@ -2510,7 +2581,7 @@ async function runTransactionFixtures() {
       check(
         "损坏/既有 pending marker → install 不 spawn、不覆盖证据、不遗留新 snapshot",
         outcome.status === "failed"
-          && /already has a pending install marker/.test(outcome.detail ?? "")
+          && /unreadable pending marker/.test(outcome.detail ?? "")
           && calls.length === 0
           && readFileSync(marker, "utf8") === corruptBytes
           && leftoverSnapshots.length === 0,
@@ -2567,7 +2638,9 @@ async function runTransactionFixtures() {
   }
 
   // 4a. spawn 计划（纯函数）：非 Windows 无 shell；Windows 有 .exe 则
-  // shell:false，仅 .cmd 则 shell:true + treeKill，全找不到回退 "pnpm"。
+  // shell:false，仅 .cmd 则 shell:true + treeKill 且 command 自带引号
+  // （.cmd 常在 `D:\Program Files\nodejs` 这类带空格的目录里，shell:true 下
+  // Node 只拼空格不逐参数引用，不引用就从空格截断），全找不到回退 "pnpm"。
   {
     const shimDir = mkdtempSync(join(tmpdir(), "dsh-mall-selftest-path-"));
     try {
@@ -2577,15 +2650,36 @@ async function runTransactionFixtures() {
       const missingOk = planMissing.command === "pnpm" && planMissing.shell === true && planMissing.treeKill === true;
       writeFileSync(join(shimDir, "pnpm.cmd"), "@echo off\r\n");
       const planCmd = pnpmSpawnPlan({ platform: "win32", pathEnv: shimDir });
-      const cmdOk = planCmd.command === join(shimDir, "pnpm.cmd") && planCmd.shell === true && planCmd.treeKill === true;
+      const cmdOk = planCmd.command === `"${join(shimDir, "pnpm.cmd")}"` && planCmd.shell === true && planCmd.treeKill === true;
       writeFileSync(join(shimDir, "pnpm.exe"), "MZ");
       const planExe = pnpmSpawnPlan({ platform: "win32", pathEnv: shimDir });
       const exeOk = planExe.command === join(shimDir, "pnpm.exe") && planExe.shell === false && planExe.treeKill === false;
       check(
-        "pnpmSpawnPlan：posix 直起 / win32 优先 .exe 无 shell / 仅 .cmd 则 treeKill",
+        "pnpmSpawnPlan：posix 直起 / win32 优先 .exe 无 shell / 仅 .cmd 则带引号 + treeKill",
         posixOk && missingOk && cmdOk && exeOk,
         JSON.stringify({ planPosix, planMissing, planCmd, planExe }),
       );
+      // 空格目录不是假想敌：Node 默认装进 Program Files，真实机器上命令从
+      // 空格截断曾让「'D:\Program' 不是内部或外部命令」拦下所有预检。
+      const spaceDir = join(shimDir, "dir with space");
+      mkdirSync(spaceDir, { recursive: true });
+      writeFileSync(join(spaceDir, "pnpm.cmd"), "@echo probe-ok\r\n");
+      const planSpace = pnpmSpawnPlan({ platform: "win32", pathEnv: spaceDir });
+      check(
+        "pnpmSpawnPlan：带空格的 .cmd 路径 → command 自带引号",
+        planSpace.shell === true && planSpace.command === `"${join(spaceDir, "pnpm.cmd")}"`,
+        JSON.stringify(planSpace),
+      );
+      // 引用必须真的可跑：Windows 真机端到端 spawn 一轮假 shim（CI 是 Linux，
+      // 只跑静态断言；Windows 上这一条覆盖完整链路）。
+      if (process.platform === "win32") {
+        const probe = spawnSync(planSpace.command, ["--version"], { shell: planSpace.shell, encoding: "utf8", timeout: 15000 });
+        check(
+          "pnpmSpawnPlan：带引号 command 真实 spawn 不再被空格截断",
+          probe.status === 0 && /probe-ok/.test(probe.stdout ?? ""),
+          `status=${probe.status} stdout=${JSON.stringify((probe.stdout ?? "").slice(0, 80))} stderr=${JSON.stringify((probe.stderr ?? "").slice(0, 80))}`,
+        );
+      }
     } finally {
       rmSync(shimDir, { recursive: true, force: true });
     }